CyberSec.Space Logo
Back to CVE Browser

CVE-2009-0886

MEDIUM
5.0
CVSS Severity Score
EPSS Score0.0170%
EPSS Percentile27.05th
PublishedMar 12, 2009
Last ModifiedApr 23, 2026

Vulnerability Description

Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.

Affected Platforms (CPE)

📦
Oneorzero

Oneorzero Helpdesk

<= 1.6.5.7
📦
Oneorzero

Oneorzero Helpdesk

= 1.4_rc4
📦
Oneorzero

Oneorzero Helpdesk

= 1.6
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.3
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.3.0
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.4
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.4.1
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.4.2
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.5.3
📦
Oneorzero

Oneorzero Helpdesk

= 1.6.5.4

References & Advisories

🔗 http://www.securityfocus.com/bid/34029
🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/49114
🔗 https://www.exploit-db.com/exploits/8168
🔗 https://www.exploit-db.com/exploits/8169
🔗 http://www.securityfocus.com/bid/34029
🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/49114
🔗 https://www.exploit-db.com/exploits/8168
🔗 https://www.exploit-db.com/exploits/8169

Related Vulnerabilities

CVE-2006-54747.5

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current time...

CVE-2007-57274.3

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly...

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...

CVE-2026-121905.3

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the compo...